External risk intelligence

NVK iBSG v3.5 Hardcoded Root Password SSH Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-39808

The product is an Intelligent Broadband Subscriber Gateway, which is typically deployed as a network edge appliance. SSH services on such gateway devices are often exposed or reachable as part of their management interface, making them commonly accessible in network-adjacent or public-facing deployment scenarios.

Nvki Intelligent Broadband Subscriber Gateway

3.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in N.V.K.INTER CO., LTD.'s Intelligent Broadband Subscriber Gateway software that could allow unauthorized access to the system. This issue arises from a hardcoded root password within the software, enabling attackers to log in with root privileges through the SSH service without needing any prior authentication.

System access flaw found in gateway software.
Critical access allows unauthorized root control.
Confirm product relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage the hardcoded root password in the SSH service to gain immediate root access to the system. This would allow them to perform any action on the device, including modifying system configurations, accessing sensitive data, or disrupting services.

Unauthenticated network access to SSH service.
Login with hardcoded root credentials.
Full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A hardcoded root password in the iBSG system could allow an unauthorized individual to gain administrative control of the device. This access could enable them to modify the system's configuration, intercept or alter network traffic passing through it, or potentially disrupt its services when exposed to the network.

Root access to the gateway.
Login via SSH service.
Service disruption or data interception.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NVK iBSG, a network edge appliance, is susceptible to unauthorized root access due to a hardcoded password, posing a critical risk. Responsibility likely falls to infrastructure or network teams to identify and secure these devices. The immediate priority is to ascertain the presence and exposure of iBSG units, confirm business criticality, and then initiate a coordinated remediation plan, potentially involving vendor engagement.

Network/Infrastructure teams should own remediation.
Verify device exposure and business criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NVK Intelligent Broadband Subscriber Gateway?

NVK iBSG is a network gateway product used to manage and route subscriber traffic. It typically functions as an edge appliance, sitting at the boundary of a network to handle authentication, billing, and connectivity for users accessing the internet or a managed service network.

What does CWE-798 mean for CVE-2023-39808?

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798). It means the software contains a secret, unchangeable password embedded directly into its code. In this specific case, the presence of this fixed root password allows anyone who knows the secret to bypass standard authentication and gain full administrative control over the gateway via SSH.

How can an attacker trigger this vulnerability?

An attacker initiates the trigger by attempting an SSH connection to the affected gateway. If the device's SSH service is accessible, the attacker provides the hardcoded root credentials to gain immediate, unrestricted access. Simply having the service turned on is the primary precondition; the bug is not triggered by specific user actions or traffic patterns, but rather by the existence of the embedded password itself.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that iBSG units are frequently deployed as network edge appliances. Because these gateways often have their management interfaces—specifically SSH—reachable from the internet or network-adjacent environments, they are at a higher risk of being discovered and targeted by unauthorized parties.

How should I respond if I am running this software?

First, identify all instances of NVK iBSG v3.5 within your infrastructure to assess their business criticality. Once located, verify if their SSH interfaces are accessible from untrusted networks. Prioritize restricting network access to these management ports and contact the vendor directly for guidance on authorized patches or configuration changes to remove the hardcoded credential.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.